Death by Doki: Eine neue Docker-Schwachstelle mit ernstem Biss (und was du dagegen tun kannst)
In Japanese onomatopoeia, the phrase "doki-doki" ("""") represents the sound of a heavily beating heart... which is exactly what members of the security team might experience if their Docker server is infected with Doki, a new vulnerability that provides a back door for malicious code injection, and much more. A fitting name, to say the least.
As we adopt an increasing dependency on cloud infrastructure, the need for precision and scalable effectiveness of security best practices is vital, and it needs to extend far beyond the bare minimum for secure application deployment, with custom measures for container security made known and deployed throughout the SDLC.
Cyberattacks are only getting more frequent, and threats affecting Linux-based infrastructure are becoming more common, with the end goal being an opportunity to crack open a loot chest of sensitive data stored in the cloud. Doki aims to do just that, and its use of multiple technologies to remain undetected, powerful, and effective is unlike anything previously seen in the realm of Docker-based security issues.
What is Doki, and how does it work?
As is a common theme in many compromised applications, security misconfiguration plays an unacceptably large role in how software was breached. For Docker specifically, misconfigured Docker Engine API has proven fruitful for attackers. The Ngrok Botnet cryptomining bot has been sniffing around for insecure Docker servers since 2018, spinning up its own containers and executing malware on the victim's infrastructure.
Doki is a more cunning, malicious version of this malware, made successful through the same botnet exposing the same attack vector: API misconfiguration, which should have been addressed well before any code deployment or public visibility of the server. Doki utilizes the blockchain of everyone's favorite satirical cryptocurrency, Dogecoin, to act as a virtually undetectable back door. As it stands, it has slithered around without much of a trace since January.
The malware essentially abuses a blockchain wallet in order to generate command-and-control (C2) domain names, which is not new in and of itself, but Doki provides a continuous capability for remote code execution on an infected server, making way for a range of damaging malware-based attacks, like ransomware and DDoS. It is relentless, like a "Doge with a bone", if you will. The good folks at Intezer have a full write-up on the entire threat and its sprawling payload.
Spotting a Doki pathway in code.
The fact that Doki is a backdoor operating on a decentralized blockchain network, employing elusive and rapid container escape techniques to cover tracks, access more areas of the host and continue spreading the infection, makes it somewhat of a nightmare for developers and security teams alike.
Still, Doki cannot infect a Docker server that has secure API ports. Misconfiguring those during production is a mistake with far-reaching consequences, but effective training on both security awareness and practical secure coding skills for cloud developers is a somewhat "simple" fix, in the face of such a complex and hard-hitting piece of malware.
Let's take a look at this example of an insecure Docker API, one where Doki could find a way in and start spreading:
dockerd -H tcp://0.0.0.0:2375
Can you spot the misconfigurations? The secured version looks like this:
dockerd -H tcp://0.0.0.0:2376 --tlsverify --tlscacert=/etc/ssl/certs/ca.pem --tlscert=/etc/ssl/certs/server-cert.pem --tlskey=/etc/ssl/private/server-key.pem
In the insecure example, the Docker Engine API is listening on port TCP 2375, and it will accept any connection request, so it is available to anyone reaching the Docker server.
In the secure example, the Docker Engine API has been configured to use TLS certificate validation, and it will only accept connections from clients providing a certificate trusted by your CA.
We have an all-new set of gamified challenges to help developers identify and fix the root cause of a Doki infection, and you can play one here:
Secure cloud infrastructure is a team sport.
Cloud misconfigurations cost organizations a mind-blowing $5 trillion over 2018 and 2019, representing billions of exposed records and irreversible reputation damage. For an attack vector that is largely avoidable, this is a rather alarming statistic. And to think that measures like monitoring for and fixing exposed ports (ideally before deployment), checking for any unknown containers, and keeping an eye on any excessive server load could stop the snowballing damage of something like Doki, well, it's a small price to pay for peace of mind.
Company-wide security awareness is critical, and for every single person involved in the SDLC, operating with security best practices is not negotiable. The best organizations are committed to a solid DevSecOps process, where responsibility for security is shared, and developers and AppSec professionals alike have the knowledge and tools to stop common vulnerabilities from making their way into software, and in vital infrastructure.
Want to get started as a security-aware, supercharged cloud engineer? Start testing your skills now.
Cyberangriffe werden immer häufiger und Bedrohungen, die Linux-basierte Infrastrukturen betreffen, werden immer häufiger. Das Endziel ist die Gelegenheit, eine Beutekiste mit sensiblen Daten, die in der Cloud gespeichert sind, zu öffnen.
Matias Madou, Ph.D. ist Sicherheitsexperte, Forscher, CTO und Mitbegründer von Secure Code Warrior. Matias promovierte an der Universität Gent in Anwendungssicherheit mit Schwerpunkt auf statischen Analyselösungen. Später kam er zu Fortify in den USA, wo er feststellte, dass es nicht ausreichte, ausschließlich Codeprobleme zu erkennen, ohne Entwicklern beim Schreiben von sicherem Code zu helfen. Dies inspirierte ihn dazu, Produkte zu entwickeln, die Entwickler unterstützen, die Sicherheitslast verringern und die Erwartungen der Kunden übertreffen. Wenn er nicht als Teil von Team Awesome an seinem Schreibtisch sitzt, steht er gerne auf der Bühne und präsentiert auf Konferenzen wie der RSA Conference, BlackHat und DefCon.
Secure Code Warrior ist für Ihr Unternehmen da, um Ihnen zu helfen, Code während des gesamten Softwareentwicklungszyklus zu sichern und eine Kultur zu schaffen, in der Cybersicherheit an erster Stelle steht. Ganz gleich, ob Sie AppSec-Manager, Entwickler, CISO oder jemand anderes sind, der sich mit Sicherheit befasst, wir können Ihrem Unternehmen helfen, die mit unsicherem Code verbundenen Risiken zu reduzieren.
Eine Demo buchen
Matias Madou, Ph.D. ist Sicherheitsexperte, Forscher, CTO und Mitbegründer von Secure Code Warrior. Matias promovierte an der Universität Gent in Anwendungssicherheit mit Schwerpunkt auf statischen Analyselösungen. Später kam er zu Fortify in den USA, wo er feststellte, dass es nicht ausreichte, ausschließlich Codeprobleme zu erkennen, ohne Entwicklern beim Schreiben von sicherem Code zu helfen. Dies inspirierte ihn dazu, Produkte zu entwickeln, die Entwickler unterstützen, die Sicherheitslast verringern und die Erwartungen der Kunden übertreffen. Wenn er nicht als Teil von Team Awesome an seinem Schreibtisch sitzt, steht er gerne auf der Bühne und präsentiert auf Konferenzen wie der RSA Conference, BlackHat und DefCon.
Matias ist Forscher und Entwickler mit mehr als 15 Jahren praktischer Erfahrung in der Softwaresicherheit. Er hat Lösungen für Unternehmen wie Fortify Software und sein eigenes Unternehmen Sensei Security entwickelt. Im Laufe seiner Karriere hat Matias mehrere Forschungsprojekte zur Anwendungssicherheit geleitet, die zu kommerziellen Produkten geführt haben, und verfügt über mehr als 10 Patente. Wenn er nicht an seinem Schreibtisch ist, war Matias als Ausbilder für fortgeschrittene Schulungen zur Anwendungssicherheit tätig und hält regelmäßig Vorträge auf globalen Konferenzen wie RSA Conference, Black Hat, DefCon, BSIMM, OWASP AppSec und BruCon.
Matias hat an der Universität Gent in Computertechnik promoviert, wo er Anwendungssicherheit durch Programmverschleierung studierte, um das Innenleben einer Anwendung zu verbergen.
In Japanese onomatopoeia, the phrase "doki-doki" ("""") represents the sound of a heavily beating heart... which is exactly what members of the security team might experience if their Docker server is infected with Doki, a new vulnerability that provides a back door for malicious code injection, and much more. A fitting name, to say the least.
As we adopt an increasing dependency on cloud infrastructure, the need for precision and scalable effectiveness of security best practices is vital, and it needs to extend far beyond the bare minimum for secure application deployment, with custom measures for container security made known and deployed throughout the SDLC.
Cyberattacks are only getting more frequent, and threats affecting Linux-based infrastructure are becoming more common, with the end goal being an opportunity to crack open a loot chest of sensitive data stored in the cloud. Doki aims to do just that, and its use of multiple technologies to remain undetected, powerful, and effective is unlike anything previously seen in the realm of Docker-based security issues.
What is Doki, and how does it work?
As is a common theme in many compromised applications, security misconfiguration plays an unacceptably large role in how software was breached. For Docker specifically, misconfigured Docker Engine API has proven fruitful for attackers. The Ngrok Botnet cryptomining bot has been sniffing around for insecure Docker servers since 2018, spinning up its own containers and executing malware on the victim's infrastructure.
Doki is a more cunning, malicious version of this malware, made successful through the same botnet exposing the same attack vector: API misconfiguration, which should have been addressed well before any code deployment or public visibility of the server. Doki utilizes the blockchain of everyone's favorite satirical cryptocurrency, Dogecoin, to act as a virtually undetectable back door. As it stands, it has slithered around without much of a trace since January.
The malware essentially abuses a blockchain wallet in order to generate command-and-control (C2) domain names, which is not new in and of itself, but Doki provides a continuous capability for remote code execution on an infected server, making way for a range of damaging malware-based attacks, like ransomware and DDoS. It is relentless, like a "Doge with a bone", if you will. The good folks at Intezer have a full write-up on the entire threat and its sprawling payload.
Spotting a Doki pathway in code.
The fact that Doki is a backdoor operating on a decentralized blockchain network, employing elusive and rapid container escape techniques to cover tracks, access more areas of the host and continue spreading the infection, makes it somewhat of a nightmare for developers and security teams alike.
Still, Doki cannot infect a Docker server that has secure API ports. Misconfiguring those during production is a mistake with far-reaching consequences, but effective training on both security awareness and practical secure coding skills for cloud developers is a somewhat "simple" fix, in the face of such a complex and hard-hitting piece of malware.
Let's take a look at this example of an insecure Docker API, one where Doki could find a way in and start spreading:
dockerd -H tcp://0.0.0.0:2375
Can you spot the misconfigurations? The secured version looks like this:
dockerd -H tcp://0.0.0.0:2376 --tlsverify --tlscacert=/etc/ssl/certs/ca.pem --tlscert=/etc/ssl/certs/server-cert.pem --tlskey=/etc/ssl/private/server-key.pem
In the insecure example, the Docker Engine API is listening on port TCP 2375, and it will accept any connection request, so it is available to anyone reaching the Docker server.
In the secure example, the Docker Engine API has been configured to use TLS certificate validation, and it will only accept connections from clients providing a certificate trusted by your CA.
We have an all-new set of gamified challenges to help developers identify and fix the root cause of a Doki infection, and you can play one here:
Secure cloud infrastructure is a team sport.
Cloud misconfigurations cost organizations a mind-blowing $5 trillion over 2018 and 2019, representing billions of exposed records and irreversible reputation damage. For an attack vector that is largely avoidable, this is a rather alarming statistic. And to think that measures like monitoring for and fixing exposed ports (ideally before deployment), checking for any unknown containers, and keeping an eye on any excessive server load could stop the snowballing damage of something like Doki, well, it's a small price to pay for peace of mind.
Company-wide security awareness is critical, and for every single person involved in the SDLC, operating with security best practices is not negotiable. The best organizations are committed to a solid DevSecOps process, where responsibility for security is shared, and developers and AppSec professionals alike have the knowledge and tools to stop common vulnerabilities from making their way into software, and in vital infrastructure.
Want to get started as a security-aware, supercharged cloud engineer? Start testing your skills now.
In Japanese onomatopoeia, the phrase "doki-doki" ("""") represents the sound of a heavily beating heart... which is exactly what members of the security team might experience if their Docker server is infected with Doki, a new vulnerability that provides a back door for malicious code injection, and much more. A fitting name, to say the least.
As we adopt an increasing dependency on cloud infrastructure, the need for precision and scalable effectiveness of security best practices is vital, and it needs to extend far beyond the bare minimum for secure application deployment, with custom measures for container security made known and deployed throughout the SDLC.
Cyberattacks are only getting more frequent, and threats affecting Linux-based infrastructure are becoming more common, with the end goal being an opportunity to crack open a loot chest of sensitive data stored in the cloud. Doki aims to do just that, and its use of multiple technologies to remain undetected, powerful, and effective is unlike anything previously seen in the realm of Docker-based security issues.
What is Doki, and how does it work?
As is a common theme in many compromised applications, security misconfiguration plays an unacceptably large role in how software was breached. For Docker specifically, misconfigured Docker Engine API has proven fruitful for attackers. The Ngrok Botnet cryptomining bot has been sniffing around for insecure Docker servers since 2018, spinning up its own containers and executing malware on the victim's infrastructure.
Doki is a more cunning, malicious version of this malware, made successful through the same botnet exposing the same attack vector: API misconfiguration, which should have been addressed well before any code deployment or public visibility of the server. Doki utilizes the blockchain of everyone's favorite satirical cryptocurrency, Dogecoin, to act as a virtually undetectable back door. As it stands, it has slithered around without much of a trace since January.
The malware essentially abuses a blockchain wallet in order to generate command-and-control (C2) domain names, which is not new in and of itself, but Doki provides a continuous capability for remote code execution on an infected server, making way for a range of damaging malware-based attacks, like ransomware and DDoS. It is relentless, like a "Doge with a bone", if you will. The good folks at Intezer have a full write-up on the entire threat and its sprawling payload.
Spotting a Doki pathway in code.
The fact that Doki is a backdoor operating on a decentralized blockchain network, employing elusive and rapid container escape techniques to cover tracks, access more areas of the host and continue spreading the infection, makes it somewhat of a nightmare for developers and security teams alike.
Still, Doki cannot infect a Docker server that has secure API ports. Misconfiguring those during production is a mistake with far-reaching consequences, but effective training on both security awareness and practical secure coding skills for cloud developers is a somewhat "simple" fix, in the face of such a complex and hard-hitting piece of malware.
Let's take a look at this example of an insecure Docker API, one where Doki could find a way in and start spreading:
dockerd -H tcp://0.0.0.0:2375
Can you spot the misconfigurations? The secured version looks like this:
dockerd -H tcp://0.0.0.0:2376 --tlsverify --tlscacert=/etc/ssl/certs/ca.pem --tlscert=/etc/ssl/certs/server-cert.pem --tlskey=/etc/ssl/private/server-key.pem
In the insecure example, the Docker Engine API is listening on port TCP 2375, and it will accept any connection request, so it is available to anyone reaching the Docker server.
In the secure example, the Docker Engine API has been configured to use TLS certificate validation, and it will only accept connections from clients providing a certificate trusted by your CA.
We have an all-new set of gamified challenges to help developers identify and fix the root cause of a Doki infection, and you can play one here:
Secure cloud infrastructure is a team sport.
Cloud misconfigurations cost organizations a mind-blowing $5 trillion over 2018 and 2019, representing billions of exposed records and irreversible reputation damage. For an attack vector that is largely avoidable, this is a rather alarming statistic. And to think that measures like monitoring for and fixing exposed ports (ideally before deployment), checking for any unknown containers, and keeping an eye on any excessive server load could stop the snowballing damage of something like Doki, well, it's a small price to pay for peace of mind.
Company-wide security awareness is critical, and for every single person involved in the SDLC, operating with security best practices is not negotiable. The best organizations are committed to a solid DevSecOps process, where responsibility for security is shared, and developers and AppSec professionals alike have the knowledge and tools to stop common vulnerabilities from making their way into software, and in vital infrastructure.
Want to get started as a security-aware, supercharged cloud engineer? Start testing your skills now.
Klicken Sie auf den Link unten und laden Sie das PDF dieser Ressource herunter.
Secure Code Warrior ist für Ihr Unternehmen da, um Ihnen zu helfen, Code während des gesamten Softwareentwicklungszyklus zu sichern und eine Kultur zu schaffen, in der Cybersicherheit an erster Stelle steht. Ganz gleich, ob Sie AppSec-Manager, Entwickler, CISO oder jemand anderes sind, der sich mit Sicherheit befasst, wir können Ihrem Unternehmen helfen, die mit unsicherem Code verbundenen Risiken zu reduzieren.
Bericht ansehenEine Demo buchen
Matias Madou, Ph.D. ist Sicherheitsexperte, Forscher, CTO und Mitbegründer von Secure Code Warrior. Matias promovierte an der Universität Gent in Anwendungssicherheit mit Schwerpunkt auf statischen Analyselösungen. Später kam er zu Fortify in den USA, wo er feststellte, dass es nicht ausreichte, ausschließlich Codeprobleme zu erkennen, ohne Entwicklern beim Schreiben von sicherem Code zu helfen. Dies inspirierte ihn dazu, Produkte zu entwickeln, die Entwickler unterstützen, die Sicherheitslast verringern und die Erwartungen der Kunden übertreffen. Wenn er nicht als Teil von Team Awesome an seinem Schreibtisch sitzt, steht er gerne auf der Bühne und präsentiert auf Konferenzen wie der RSA Conference, BlackHat und DefCon.
Matias ist Forscher und Entwickler mit mehr als 15 Jahren praktischer Erfahrung in der Softwaresicherheit. Er hat Lösungen für Unternehmen wie Fortify Software und sein eigenes Unternehmen Sensei Security entwickelt. Im Laufe seiner Karriere hat Matias mehrere Forschungsprojekte zur Anwendungssicherheit geleitet, die zu kommerziellen Produkten geführt haben, und verfügt über mehr als 10 Patente. Wenn er nicht an seinem Schreibtisch ist, war Matias als Ausbilder für fortgeschrittene Schulungen zur Anwendungssicherheit tätig und hält regelmäßig Vorträge auf globalen Konferenzen wie RSA Conference, Black Hat, DefCon, BSIMM, OWASP AppSec und BruCon.
Matias hat an der Universität Gent in Computertechnik promoviert, wo er Anwendungssicherheit durch Programmverschleierung studierte, um das Innenleben einer Anwendung zu verbergen.
In Japanese onomatopoeia, the phrase "doki-doki" ("""") represents the sound of a heavily beating heart... which is exactly what members of the security team might experience if their Docker server is infected with Doki, a new vulnerability that provides a back door for malicious code injection, and much more. A fitting name, to say the least.
As we adopt an increasing dependency on cloud infrastructure, the need for precision and scalable effectiveness of security best practices is vital, and it needs to extend far beyond the bare minimum for secure application deployment, with custom measures for container security made known and deployed throughout the SDLC.
Cyberattacks are only getting more frequent, and threats affecting Linux-based infrastructure are becoming more common, with the end goal being an opportunity to crack open a loot chest of sensitive data stored in the cloud. Doki aims to do just that, and its use of multiple technologies to remain undetected, powerful, and effective is unlike anything previously seen in the realm of Docker-based security issues.
What is Doki, and how does it work?
As is a common theme in many compromised applications, security misconfiguration plays an unacceptably large role in how software was breached. For Docker specifically, misconfigured Docker Engine API has proven fruitful for attackers. The Ngrok Botnet cryptomining bot has been sniffing around for insecure Docker servers since 2018, spinning up its own containers and executing malware on the victim's infrastructure.
Doki is a more cunning, malicious version of this malware, made successful through the same botnet exposing the same attack vector: API misconfiguration, which should have been addressed well before any code deployment or public visibility of the server. Doki utilizes the blockchain of everyone's favorite satirical cryptocurrency, Dogecoin, to act as a virtually undetectable back door. As it stands, it has slithered around without much of a trace since January.
The malware essentially abuses a blockchain wallet in order to generate command-and-control (C2) domain names, which is not new in and of itself, but Doki provides a continuous capability for remote code execution on an infected server, making way for a range of damaging malware-based attacks, like ransomware and DDoS. It is relentless, like a "Doge with a bone", if you will. The good folks at Intezer have a full write-up on the entire threat and its sprawling payload.
Spotting a Doki pathway in code.
The fact that Doki is a backdoor operating on a decentralized blockchain network, employing elusive and rapid container escape techniques to cover tracks, access more areas of the host and continue spreading the infection, makes it somewhat of a nightmare for developers and security teams alike.
Still, Doki cannot infect a Docker server that has secure API ports. Misconfiguring those during production is a mistake with far-reaching consequences, but effective training on both security awareness and practical secure coding skills for cloud developers is a somewhat "simple" fix, in the face of such a complex and hard-hitting piece of malware.
Let's take a look at this example of an insecure Docker API, one where Doki could find a way in and start spreading:
dockerd -H tcp://0.0.0.0:2375
Can you spot the misconfigurations? The secured version looks like this:
dockerd -H tcp://0.0.0.0:2376 --tlsverify --tlscacert=/etc/ssl/certs/ca.pem --tlscert=/etc/ssl/certs/server-cert.pem --tlskey=/etc/ssl/private/server-key.pem
In the insecure example, the Docker Engine API is listening on port TCP 2375, and it will accept any connection request, so it is available to anyone reaching the Docker server.
In the secure example, the Docker Engine API has been configured to use TLS certificate validation, and it will only accept connections from clients providing a certificate trusted by your CA.
We have an all-new set of gamified challenges to help developers identify and fix the root cause of a Doki infection, and you can play one here:
Secure cloud infrastructure is a team sport.
Cloud misconfigurations cost organizations a mind-blowing $5 trillion over 2018 and 2019, representing billions of exposed records and irreversible reputation damage. For an attack vector that is largely avoidable, this is a rather alarming statistic. And to think that measures like monitoring for and fixing exposed ports (ideally before deployment), checking for any unknown containers, and keeping an eye on any excessive server load could stop the snowballing damage of something like Doki, well, it's a small price to pay for peace of mind.
Company-wide security awareness is critical, and for every single person involved in the SDLC, operating with security best practices is not negotiable. The best organizations are committed to a solid DevSecOps process, where responsibility for security is shared, and developers and AppSec professionals alike have the knowledge and tools to stop common vulnerabilities from making their way into software, and in vital infrastructure.
Want to get started as a security-aware, supercharged cloud engineer? Start testing your skills now.
Inhaltsverzeichniss
Matias Madou, Ph.D. ist Sicherheitsexperte, Forscher, CTO und Mitbegründer von Secure Code Warrior. Matias promovierte an der Universität Gent in Anwendungssicherheit mit Schwerpunkt auf statischen Analyselösungen. Später kam er zu Fortify in den USA, wo er feststellte, dass es nicht ausreichte, ausschließlich Codeprobleme zu erkennen, ohne Entwicklern beim Schreiben von sicherem Code zu helfen. Dies inspirierte ihn dazu, Produkte zu entwickeln, die Entwickler unterstützen, die Sicherheitslast verringern und die Erwartungen der Kunden übertreffen. Wenn er nicht als Teil von Team Awesome an seinem Schreibtisch sitzt, steht er gerne auf der Bühne und präsentiert auf Konferenzen wie der RSA Conference, BlackHat und DefCon.
Secure Code Warrior ist für Ihr Unternehmen da, um Ihnen zu helfen, Code während des gesamten Softwareentwicklungszyklus zu sichern und eine Kultur zu schaffen, in der Cybersicherheit an erster Stelle steht. Ganz gleich, ob Sie AppSec-Manager, Entwickler, CISO oder jemand anderes sind, der sich mit Sicherheit befasst, wir können Ihrem Unternehmen helfen, die mit unsicherem Code verbundenen Risiken zu reduzieren.
Eine Demo buchenHerunterladenRessourcen für den Einstieg
Trust Agent:AI - Secure and scale AI-Drive development
AI is writing code. Who’s governing it? With up to 50% of AI-generated code containing security weaknesses, managing AI risk is critical. Discover how SCW's Trust Agent: AI provides the real-time visibility, proactive governance, and targeted upskilling needed to scale AI-driven development securely.
The Power of OpenText Application Security + Secure Code Warrior
OpenText Application Security and Secure Code Warrior combine vulnerability detection with AI Software Governance and developer capability. Together, they help organizations reduce risk, strengthen secure coding practices, and confidently adopt AI-driven development.
Secure Code Warrior corporate overview
Secure Code Warrior is an AI Software Governance platform designed to enable organizations to safely adopt AI-driven development by bridging the gap between development velocity and enterprise security. The platform addresses the "Visibility Gap," where security teams often lack insights into shadow AI coding tools and the origins of production code.
Themen und Inhalte der Securecode-Schulung
Unsere branchenführenden Inhalte werden ständig weiterentwickelt, um der sich ständig ändernden Softwareentwicklungslandschaft unter Berücksichtigung Ihrer Rolle gerecht zu werden. Themen, die alles von KI bis XQuery Injection abdecken und für eine Vielzahl von Rollen angeboten werden, von Architekten und Ingenieuren bis hin zu Produktmanagern und QA. Verschaffen Sie sich einen kleinen Einblick in das Angebot unseres Inhaltskatalogs nach Themen und Rollen.
.png)
